PT-2008-5458 · Unknown · Zanfi Cms Lite+1

Cru3L.B0Y · Published 2008-09-22 · Updated 2017-09-29 · CVE-2008-4159

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jaw Portal (affected versions not specified) Zanfi CMS lite (affected versions not specified)

Description The issue allows remote attackers to execute arbitrary SQL commands via the pageid parameter in the "index.php" file. This can be exploited by sending a malicious request to the /index.php endpoint.

Recommendations For Jaw Portal, update the index.php file to properly sanitize the pageid parameter to prevent SQL injection. For Zanfi CMS lite, update the index.php file to properly sanitize the pageid parameter to prevent SQL injection. As a temporary workaround, consider restricting access to the index.php file until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2008-4159

Affected Products

Jaw Portal

Zanfi Cms Lite

References · 5

• 🔥 https://exploit-db.com/exploits/6423 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-4159 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45029 · Note
• http://securityreason.com/securityalert/4283 · Note
• http://securityfocus.com/bid/31116 · Note